Español

Domotic

Privacy policy

Who is responsible

Gabriel Micó Victoria, developer of Domotic. For any question about your data, or to exercise your rights, write to gabrielmicovictoria@gmail.com.

What stays on your phone

• Your devices: name, type, address on your network or Bluetooth identifier, and the names and settings of each circuit.
• Your devices' keys (Tuya local key, a Shelly or Tasmota password, a Home Assistant token, the user a Hue Bridge gives you when you pair it, the Nanoleaf token and the password of your TP-Link account, which Tapo bulbs and plugs and some Kasa devices ask for; the username and password of your cameras; the tokens of brand accounts; the token of each Xiaomi device; Domotic's keys on your Matter network) and the administrator codes of the Station and the Remote: in the iPhone keychain. They are never sent to Firebase or to any server of ours: they are only used to talk to the device, camera or brand they belong to. The TP-Link account is only used to talk to the bulb or plug inside your network; that account's email is stored on the phone with the device's settings.
• The switching log (which command, when, on which circuit and with what result) and your settings.
• Cameras: address, ports and profile. While you look at a card, a few single temporary images in the system cache (excluded from backups and never in Photos), deleted when the app goes to the background. There is no recording and no video history. The demo camera uses a clip that is already inside the app, marked “DEMO”: it is not a real camera.
• Matter: Domotic's identity on your Matter network (in the keychain) and the list of your Matter devices with their latest data. The device's QR is read by iOS's own pairing sheet, not by the app; the temporary pairing code that Domotic's extension hands to the app (through a keychain shared by the two) is used once to add the device and then deleted.
• Door locks: when a Matter lock reports that it was unlocked or locked and how (by hand, keypad, fingerprint, remotely...), with the user number the lock itself gives, next to what was asked from the app. PINs, credentials and user names are never stored, and none of this leaves the phone.
• The history of power and energy for the whole house, each device and each circuit and, depending on what it is, leakage, hours on and when it opened (trips). It is stored for everyone, with Pro or without, while the app is connected; what depends on Pro is seeing it (see "Free and Pro").
• The code of your Station or of the panel you watch, the chosen mode and the language.
• Your favourites, the tab you moved each device to and the order of the tabs, the colour theme you have on and, if you bought the theme pack, which three you picked. Which themes you have bought is confirmed by the store (see “RevenueCat”): only the one you use is kept on the phone.
• The price per kWh, if you enter it, to work out the cost. The cost is shown in the currency of your phone's region: the app only reads the system language and region, and neither stores nor sends them.
• A marker that you have already linked two phones (Station and Remote), so that the reminder to connect two phones shown when opening the app stops appearing. Nothing is sent because of it.
• The launch counter and the installation day, for the free version's opening ad (1 launch in 5, never on the day of installation).

All of this is deleted when you uninstall the app. Inside the app you can delete each device (its key is also removed from the keychain).

What leaves your phone, and where it goes

To your devices (local network, Bluetooth and Matter)

To find and read your devices, Domotic scans your home WiFi network (only your own local network) and listens over Bluetooth. It talks only to devices on your network, or to the Home Assistant or MQTT server whose address you type in. iOS asks your permission for the local network and for Bluetooth. Location is not used.

Matter. To add a Matter device, iOS shows its own pairing sheet (MatterSupport), which scans the device's QR or lets you type its code, and a small Domotic extension hands the app a temporary pairing code. After that Domotic talks to the device over your home network, with its own identity (kept in the keychain). There is no cloud and no third party, and if the device was already in Apple Home, Google Home or Alexa, it keeps working there. Matter needs iOS 17.6 or later; on an older iPhone the app works the same, without Matter. For a Matter camera the app only detects that it exists: its video is not opened in this version.

Xiaomi / Mi Home. Xiaomi devices (plugs, bulbs, air purifiers, fans, dehumidifiers and robot vacuums) are driven over your home network, with no cloud, using the local miIO protocol and each device's key (token). To find them, Domotic tries addresses on your local network one by one. Robot maps, rooms and cleaning settings are not even read. The key is obtained once (see “Xiaomi account”) or you paste it yourself.

IP cameras (ONVIF and RTSP). To find them, Domotic searches your local network (only that). Then it asks the camera, over your network, for its time, its profiles, its picture and its video. The video goes straight from the camera to your phone: it is not recorded, not published and does not go through any server. Username and password go to the keychain and are only handed to the camera's own server. Most home cameras stream over RTSP and HTTP without encryption, so inside your network the video (and, depending on the camera, its password) travels unencrypted between it and your phone: use them only on a network you trust. From the Remote the cameras cannot be viewed (only their name and status).

Google Firebase Realtime Database (only with Station or Remote)

• What is published: the Station publishes, under a random 10-character code, the state of the panel: names of devices and circuits, whether they are open or closed, readings (power, voltage, current, energy, leakage, temperature, frequency), alarms, which operations you have allowed, what each card shows for anything that is not electrical (sensors: door open or closed, motion, smoke, CO or water alarm, frost, rain, temperature, humidity and battery; whether a lock is locked or unlocked and whether you allow unlocking it from the app; position of blinds, curtains and doors; thermostat, air conditioner, fan, air purifier and ambient station (temperature, humidity, pressure, light level and air quality); car charger, water heater, heat pump, solar panels and battery; status of appliances and robot vacuums; the last press of a button; and, for a camera, only its name, whether it is online and whether it detects motion) and a summary of the history for the last month and year (energy, hours on and the latest openings of each device and circuit), with Pro or without: the history is stored for everyone and the Station publishes it whenever it has data, so the Remote can draw the charts.
• What is not published: no IP addresses, keys, passwords or Bluetooth addresses, no camera images or video, no camera addresses, no pairing codes, no lock PINs, no robot maps and no room names. Error texts are stripped of IPs and addresses before leaving the phone.
• Commands: a Remote with the administrator code writes signed commands (device, circuit, a named action from a closed list, such as open, close, raise a blind or pause an appliance, time, one-time number and signature) and the Station replies with the result, also signed, checking the safety rules again itself. The administrator code never goes through Firebase.
• Unlocking door locks from the Remote: off by default and switched on lock by lock. When on, besides the administrator code it asks for a one-time code valid for 60 seconds and confirmation with Face ID, fingerprint or the passcode of the remote phone itself, and the Station warns you on its phone with the lock's name (a local notification on that phone, which goes through no server). Garage doors and gates also ask for that circuit's permission and the administrator code. A smoke or CO alarm cannot be silenced and lock users or PINs cannot be changed from the app.
• Who can see it: the code is the key to the panel. Anyone with the view code can see the state, so do not share it with anyone you do not want to see it. Sending commands also needs the administrator code. You can generate new codes at any time (and the panel published under the old code is deleted).
• The Remote also writes the time it was "still watching", so the Station publishes more often while someone is watching.
• There is no account or identity: your name or email is not linked to the code. We recommend not putting personal data (full name, address) in device and circuit names, because they are published as they are.
• Server in Belgium (europe-west1). Firebase policy.

Supabase (only if you turn on notifications on the Remote)

• What it receives: your phone's Apple notification token, the panel code (the view code), the app language (to write the notification in your language), which kinds of notification you want and whether the token is for testing or production.
• What for: only to deliver your notifications (power cut, power back, trip, leakage, alarm, smoke, carbon monoxide (CO), water leak, frost and station down) through the Apple Push Notification service (APNs). It is not used for advertising and is not passed on.
• When the Station detects an event, it tells the server the code, the type of notification and, where relevant, the name of the circuit that caused it (to write it in the notification). The server keeps, for one day, a note of "which notification was sent and when" so it does not repeat them. For the "station down" notification, the server reads every 2 minutes the time of the last data the panel published (using its code) and notifies if it has not changed for more than 12 minutes; a station stopped from the app deletes its panel and does not notify. All notifications except "power back" are marked "urgent" (Time Sensitive) so they can break through Focus mode if you allow it; Apple's Critical Alerts are not requested.
• Without a Station or a server: a phone that reads the devices itself, without being a Station, also warns about smoke, CO, water leaks and frost, but with a local notification on that same phone (and the red screen for smoke, CO or water): nothing is sent to any server.
• The tables are locked: only the server function (not the app) can read them.
• Supabase policy. Apple receives the token in order to deliver the notification.

Brand accounts (only if you add one)

If in "Add → Brand account" you sign in with your Samsung SmartThings, LG ThinQ, Home Connect (Bosch, Siemens, Neff) or Miele account, your phone talks directly to that brand's servers, with your token or session, without passing through a service of ours (the only page of ours involved is Miele's return page, explained below, which only shows a code). With SmartThings and LG ThinQ you paste a personal token that you get from their portal; with Home Connect and Miele you sign in on the brand's page. With Miele, the brand sends you back to a page of ours (cdpoma.github.io/domotic/vuelta.html) that only shows you a single-use code to copy into the app: that page stores nothing. It is used to read the state of your appliances and control them in a limited way (pause, resume or turn off): Domotic never starts a cycle. The brand receives what such a connection implies (your account, your IP and what is requested) and handles it under its own policy. The token is kept in the keychain and deleted when you remove the account.

Xiaomi account (only if you use it)

Xiaomi devices are driven locally, but their key (token) is only held by the user's Xiaomi account. If in “Add → WiFi” you choose “Sign in with Xiaomi once to get the key”, your phone sends your Xiaomi email, phone number or ID and your password (and, if Xiaomi asks, the captcha and the two-step verification code) directly to Xiaomi's servers in the region you pick, over https and with no server of ours in between; the app only accepts Xiaomi domains. Xiaomi receives what such a connection implies (your account, your IP and the request for the list of your devices) and handles it under its own policy. From there the app reads, for each device, its token, model, address on your network and name. The password is never stored and the session is forgotten when finished; only each device's token is kept, in the keychain. You can also skip this step and paste the token by hand. From then on everything goes over your home network.

Google AdMob (ads, free version)

The free version shows three kinds of Google AdMob ad:

• Banner at the bottom, in normal mode, on the Remote and on the Station.
• Full-screen ad when opening the app: 1 in every 5 openings, never on the day of installation and never while the Station is on.
• Rewarded ad (video), only if you ask for it: to see the charts without Pro (not offered while the Station is on), tapping the card of a device or a line shows "This is Pro" with the button "Watch an ad and open it now". When the reward is earned, those charts open for as long as they stay open; the next time you open them another ad is requested. No unlock is stored.

Before requesting any ad, consent is asked: in the European Economic Area, the United Kingdom and Switzerland, with Google's form (UMP); on iPhone, afterwards, with Apple's tracking prompt (ATT). If you allow it, AdMob may use the device advertising identifier (IDFA) to personalise and measure ads; if not, ads still appear but are not personalised. In both cases Google receives technical device data, such as the IP address. Google receives nothing about your panel or your devices. If you do not give the consent Google's form asks for, the app stops requesting ads and works the same.

With Domotic Pro, outside Station mode, the app does not start AdMob: neither Google's form nor the tracking prompt appears. In Station mode there is a banner, also with Pro, and then they are requested.

What you chose in Google's form can be changed in the app, in Settings → "Ad privacy options" (where that form applies), and the tracking permission in iPhone Settings → Privacy & Security → Tracking. Google policy.

RevenueCat (purchases)

It checks with Apple whether you have the Domotic Pro subscription and which colour themes you have bought. It uses an anonymous installation identifier; Apple handles the payment and we never see payment details. It receives no data about your panel. If analytics has consent, RevenueCat also receives the Firebase installation identifier so that purchases appear in the same statistics. RevenueCat policy.

Firebase Analytics (usage statistics)

Domotic uses Google Analytics for Firebase on iPhone to know how many people use the app. Only the SDK's automatic events are sent (first open, session, engagement time), an installation identifier (not your name or the advertising identifier) and basic technical data (approximate country, system, app version). It does not use the advertising identifier (IDFA), assigns no user ID and sends nothing about your devices. In the European Economic Area, the United Kingdom and Switzerland it stays off until you accept Google's form; outside that area it is on by default. With Pro, outside Station mode, that form does not appear (AdMob is not started): inside that area analytics stays off and outside it is turned on according to the phone's region (the system language and region, which are only read). You can ask for it to be stopped by writing to the contact email.

App Store (mandatory update)

When the app opens it asks Apple (itunes.apple.com) for the latest Domotic version on sale. The query carries only the app's identifier; Apple sees your IP address, as with any request. Nothing about you is sent.

How to delete your data

• What is on your phone: deleted when you uninstall the app. Each device is deleted from within the app, together with its key in the keychain (cameras and brand accounts included). When you remove a Matter device, Domotic is also removed from the device itself, which keeps working in your other apps. When you remove a brand account or a Xiaomi device, its token is deleted from the keychain. The temporary camera images are deleted by themselves when the app goes to the background.
• The panel published on Firebase: when you stop the Station from the app (button "Stop the station"), the panel is deleted from the server, together with the commands, the results and the "still watching" mark. The previous panel is also deleted when you tap "New code". If there is no connection at that moment, the app notes the deletion on the phone and repeats it by itself when the network is back; if it finally cannot, it tells you on the main screen. If you uninstall the app or close it without stopping the Station, the last state stays on the server until it is overwritten or deleted: write to us with your station code and we will delete it.
• Notifications (Supabase): on the Remote, "Turn alerts off" deletes the token from the server, and "Leave remote" (or switching to Station) does it by itself. If there is no network at that moment, the app repeats it when the network is back and, if it cannot, it tells you. Each phone deletes its own token: the Station cannot delete other phones' tokens, so when you stop the Station or get a new code, the tokens stored under the old code stay until each phone leaves the Remote. If you no longer have the phone and want them deleted, write to us with the panel code and we will delete it. Apple also retires tokens of phones that no longer exist, and the server deletes them the first time Apple rejects them.
• Statistics, ads and purchases: handled by Google and RevenueCat under their policies; to ask us for deletion or to exercise your rights of access, rectification, erasure, objection or portability, write to the contact email.

Permissions

• Local network: to find and talk to your devices inside your home: lights, plugs, cameras, locks, sensors, thermostats, blinds, chargers and appliances.
• Bluetooth: for devices that speak Bluetooth and to set up nearby Matter devices.
• Camera: only to scan the Station's QR code. It takes and stores no photos. (A Matter device's QR is scanned by iOS's own pairing sheet, not by the app; IP cameras do not use the phone's camera, only the network.)
• Face ID: to confirm sensitive actions, such as unlocking a door lock, on this phone. iOS checks it and the app only receives "yes" or "no"; your face and fingerprint never leave the phone.
• Notifications: only if you turn on notifications (smoke, CO, water-leak and frost ones as urgent), or for the phone itself to warn you about them and about a lock opened from the Remote.
• Tracking: Apple's prompt before personalising ads. It only appears if the app is going to show ads.

Location, microphone, contacts and photos are not requested.

Safety

Free and Pro

• Free: find, add, read and control your devices, the Station, the Remote and notifications, with a banner, an ad when opening the app (1 launch in 5) and, to see the charts, a rewarded ad each time you open them (except while the Station is on). The history is stored for everyone.
• Domotic Pro (subscription, handled with RevenueCat): no ads (no banner, no ad when opening the app and no rewarded ad for the charts) and the charts always open. The only exception is Station mode, which shows a banner even with Pro.
• Colour themes (bought separately, with Pro or without): the default theme is free; the other twenty are paid and Pro does not include them. No feature depends on the theme.
• RevenueCat, with Apple, decides whether you have Pro. A failure while checking does not take your Pro away.

In-app purchases

Domotic Pro: €1.99/month or €14.99/year in Spain (in your country the local price is shown in the app before you pay). It renews automatically until you cancel it in iPhone Settings → your name → Subscriptions. "Restore purchases" is on the Pro screen.

Themes: they change the colours of the whole app. Each one costs €0.49 or you can buy a pack of 3 of your choice for €0.99 (in your country the local price is shown in the app before you pay). They are one-time purchases, with no subscription or renewal, and they do not expire; they are recovered with “Restore purchases” in the Themes store. Apple's standard license agreement (EULA) applies.

Children's privacy

Domotic is a technical tool for controlling electrical installations and is not directed at children. It does not knowingly collect data from children.

Changes

If any of the above changes, this page is updated and the date below changes.

Contact

Write to gabrielmicovictoria@gmail.com. If you ask us to delete a panel or a token, include the panel code.